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REMARKS 

Claims 1-50 are now pending, of which claims 1, 26, 49, and 50 are independent. Claims 
1-50 have been rejected under 35 U.S.C. §102 based on U.S. Patent No. 7,043,636 to Smeets. 
This rejection is respectfully traversed. For the reasons described below, claims 1-50 are in 
condition for allowance. 

Claim Amendments 

Independent claims 1, 26, 49, and 50 are amended to state specifically that the claimed 
approach detects execution of an unidentified software, selects portions of the or executing 
image of the unidentified software, and uses superfingerprints of protected software to identify 
the unidentified software. Independent claims 1, 26, 49, and 50 are further amended to require 
that the executing unidentified software is identified as the protected software using the 
superfingerprint, even if the executing unidentified software and the protected software are not 
exactly the same. As described in the background section of the present application, prior 
methods of software identification relied on the filename as represented in the operating system 
of the computer, on internal strings in the software, or on the size of the file on disk. Such 
methods failed to work if the software was changed at all, either for the purposes of deception or 
innocently. Unlike the prior art, the present invention can identify whether an unidentified 
software is protected software even though the unidentified software may have been changed 
innocently or deceptively. Support for this amendment can be found throughout the application, 
at least at pg. 1, lines 12-19; pg. 2, lines 8-14; pg. 4-pg. 5, lines 1-20; pg. 8; pg. 14, line 6 -pg. 
16, line 26; figs. 5-9. Thus, no new matter is introduced. Acceptance is respectfully requested. 

Claim Rejections 

Claims 1-50 have been rejected under 35 U.S.C. § 102(e) based on Smeets. This rejection 
is respectfully traversed. 

With conventional software authentication schemes, such as the authentication approach 
discussed in Smeets, protected software is accessed after successful completion of an 
authentication procedure. Smeets teaches that access to the capability of executing or to the 
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capability of modifying the protected software is permitted only after the user has passed an 
authorization procedure. See Smeets, for example, at least at col. 8, 11. 40-60 and Abstract. 

Conversely, the present invention detects executing unidentified software and uses 
superfingerprints of protected software to identify the unidentified software. Using this 
approach, the invention can identify the unidentified software even if it has been modified or 
even if it has been disguised as different software. For example, the present invention can 
identify software even when an unscrupulous user has embedded it into another, larger software 
program, to disguise the identity of the software. Smeets' authentication approach does not 
address this situation; nor does Smeets even contemplate any problems associated with 
embedding protected software into larger programs. 

Consider, for purposes of analogy, an Italian restaurant that has a large collection of 
recipes. This collection is analogous to the program text on disk. Suppose, however, that one set 
of items, say pizzas, are the most popular. Then an observer of the kitchen would mostly see the 
preparation of pizza dough, the insertion of pizza in the oven, and so on. Those are the traces of 
execution that characterize the restaurant. The result of the execution of that program is a 
particular pizza. The present invention examines the traces of execution (preparation of the 
pizza). Smeets by contrast looks at the whole collection of recipes (when talking about static 
data) or the final values of the pizza (when talking about dynamic data). Thus, because Smeets 
teaches to use the whole collection of program text (static data) or final values (dynamic data), 
Smeets does not relate to the claimed approach of selecting portions of the executing software 
(traces of the executing software) to perform the identification, and thus, Smeets does not 
disclose the requirements of the claimed invention. 

In response to applicants' arguments set forth in the amendment filed December 8, 2006, 
that Smeets does not teach the inventive approach of software identification including selecting 
portions of the executing software and performing computations on the selected portions to 
create superfingerprints, the Examiner states in the final office action dated January 18, 2007, 
that Smeets does select portions of the executing software to perform authentication. In support 
of this conclusion, the Examiner cites Smeets at column 5, lines 13-22, "program code 
implementation" and column 8, lines 40-60, "executing the program code 3 19 for the hash 
algorithm hs." As discussed in more detail below, however, neither of these cited sections of 
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Smeets relates to the inventive approach of selecting specific portions of the executing protected 
software to create the superfingerprints and perform the identification. 

Column 5, lines 13-22, of Smeets that was cited by the Examiner refers to the "program 
code implementation of the authorization method itself/' and this "program code" for Smeets 5 
authorization method does not relate to the claimed identification approach of selecting portions 
of executing protected software to create the superfingerprints. In general, when software code 
is executed by an execution engine, for example, the software code takes a different form in 
memory than it does stored on disk, and the inventive approach uses select portions of this 
advantageous executing form, the executing image of the unidentified software, to create the 
superfingerprints for identification. The claimed technique uses select portions of the protected 
software execution stream because it advantageously enables more comprehensive and versatile 
software identification. For example, with the claimed approach, when protected software is 
loaded from a remote computer as is often the case for java applets, the software takes a different 
form from when it is stored in the main memory of the computer, and the present invention 
advantageously identifies the protected software while it is executing. Smeets, however, does 
not even contemplate identifying software while it is executing. 

Moreover, Smeets's discussion of "program code implementation of the authorization 
method itself relates to system code that performs the authentication of the protected software, 
not the protected software itself. By way of contrast, the claimed invention uses a supervising 
program to perform the identification, and the supervising program selects specific portions of 
the executing protected software for identification. Thus, Smeets's "program code 
implementation of the authorization method" is system code used to authenticate protected 
software, and this system code is not the same as the claimed protected software . 

With respect to column 8, lines 40-60 of Smeets, although the Examiner is correct that 
this section does recite the term "executing," this term is taken out of context because the 
modifying descriptors before and after the term make it clear that Smeets does not execute the 
protected software until after it has been authenticated. In particular, in this section, Smeets 
specifically states that " access to the capability of executing the program code . . . Is controlled 
by an authentication procedure ." Thus, like the prior art, in Smeets the program code cannot be 
executed unless and until it has been authenticated by an authentications procedure. By way of 
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contrast, with the claimed invention, execution of the protected software is necessary to perform 
the identification. 

Therefore, it is respectfully requested that the §102 rejection of Claim 1 based on Smeets 
be reconsidered and withdrawn. For reasons similar to those set forth above with respect to 
Claim 1, independent Claims 1, 26, 49 and 50, and their respective dependent claims are not 
disclosed by Smeets. As such, it is respectfully submitted that the §102 rejection of Claims 1-50 
be reconsidered and withdrawn. 

Interview Summary 

A telephone interview was held on March 19, 2007, for the present application. The 
participants in the telephone interview were Examiner Jeremiah Avery, and Applicants' 
representatives James M. Smith and Giovanna H. Fessenden. There were no exhibits or 
demonstratives presented. 

The differences between U.S. Patent No. 7,043,636 to Smeets and the present invention 
were discussed. In particular, the Applicants' representatives explained that Smeets does not 
relate to the claimed approach for identifying software because Smeets is directed to an approach 
for authenticating software, not an approach for identifying software, as required by the claimed 
invention. 

Applicants would like to take this opportunity to thank Examiner Avery for his time and 
for his suggestions for advancing prosecution of the application. In particular, it was suggested 
that the approach to identifying software set forth in the claims should be amended to specify 
that portions of the executing image of the protected software are selected to further distinguish 
Smeets. As such, independent Claims 1, 26, 49 and 50 are amended by the present amendment 
to recite this limitation. 
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CONCLUSION 

In view of the above amendments and remarks, it is believed that all claims are in 
condition for allowance, and it is respectfully requested that the application be passed to issue. If 
the Examiner feels that a telephone conference would expedite prosecution of this case, the 
Examiner is invited to call the undersigned attorney. 



Respectfully submitted, 

HAMILTON, BROOK, SMITH & REYNOLDS, P.C. 




Giovanna H. Fessenden 
Registration No. 60,264 
Telephone: (978) 341-0036 
Facsimile: (978)341-0136 



Concord, MA 01742-9133 
Date: April 27, 2007 
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